@Avid - that's 6 posts from satishb3 now, all of which are just a link to his blog. I'll add a comment to each one, if he doesn't improve I guess we can just delete. The blog posts seem alright, but he isn't adding local content here
@AviD heh. My youngest likes bugs so much she made an insect hotel - we have planted a lot of bee and butterfly friendly plants as her class had a 'how to make your garden better for the environment' day
Slugs - I am not a fan of
beer and salt, that's the trick
they keep trying to eat my strawberries
for good advice, remember we have a gardening stack exchange
bah - still only on page two over there :-)
I still like this set of graphs - although in order to follow the wider trend that spike is a PITA:
We recently have put a lot of effort in coming up with a unique brand name for this community. As you know, naming is hard! After numerous brain storming sessions, we found a great name(and was able to obtain the domain name). It was suggested in a community chat session, and "Arqade" was chosen....
@Mvy heh. I would really like to get some of that swag, but I find it unlikely that I can make it to the second, or even 3rd, page in time. Considering that I have not gained any rep there yet.
@Mvy heh - you and @IsziRoryorIsznti are close on page 4. The link above says that they will send out new branded swag, and probably go for more than just pages 1 and 2
I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform.
We expose a REST based API which our customers either call directly from their app servers, or their own client apps can all, on behalf of their users.
Their apps a...
So I'm trying to formulate a question asking about the prospect of data loss when multiple processes write to the same file. Is 'thread-safe' still a technically appropriate term here?
I know the threading model of linux is a little...wonky, but using that word invokes certain implications in my head.
@ScottPack I think thread safe can be used here - especially if you do provide a little explanation as to the risk from the particular race conditions at work
Yeah. What I really wanted to do was, after describing the situation, simply ask if the process is known to be thread safe. Those two words are a pretty substantial shorthand.
I am beginning to migrate my snort logging from alert_syslog to unified2 using barnyard2 as the processor. In some cases I have multiple instances of snort running on the same system. Since I have historically used syslog, it handled the multiple log input without problem, however with the switch...
Same here. Syslog, just based on it's asynchronous design, handles the situation pretty trivially.
We're migrating to a new SIEM solution and learned that it selects the parsing engine based on the collection method. I.e., since both Linux events and snort events were being received via syslog it would either parse them as snort or as Linux.
So they recommend using barnyard2 for snort, which means logging out as unified2 instead of syslog.
@ScottPack interesting. I was chatting with a guy at dinner last night who runs his global event monitoring through sourcefire and logrhythms to triage 80million daily events down to 4 or 5 which need action
LogRythmn was one of our three finalists, but we ended up going with Nitro (now McAfee) instead.
I'm not sure how many daily events we actually generate, though it should be fairly easy to graph that out. I pulled together a few metrics for my talk a few weeks ago. Let's see if that was one.
Was looking through my old activity, and I sort of wonder if we should feature this lovely case example of how not to secure your computer on the blog:
I've been reading on various sites how PC get infected by viruses and I got:
Email attachments (but of course, only if I get an exe and open or execute something, right?)
Don't update windows
Downloads (the same as email attachments, right?)
Pros:
I can't think of any worthwhile.
Cons:
...
I love how he seems to have made our case for us on one hand, yet on the other hand still hasn't learned a thing: "in my case with 54 viruses apparently I have no problem and no stolen money from none of my accounts. Why I can't just live with them?"
Maybe so. Except for the attribute/filter thing (because I really wanted keyword expansion!) I haven't done any tuning. I have seen git-diff inform me of permission mode changes.
Simply put, a cache is hidden at a particular location, and clues are provided (usually via a website, but any media can work) so that searchers can find it.
The usual plan is then to open the cache, take an item from it and replace it with something you have brought, and then note your discover...
@AviD oh yeah!!! that would be a cool anniversary prize - we haven't focused on prizes with that meta post. I'm just about to get a train home - anyone fancy raising a meta question on prizes?
@ScottPack it used to be illegal here too, till they realised real criminals use an unlicenced brick
can anyone else have a look at this and see if I'm just being a dick? I don't think so, but best to get a sanity check. Have deleted some of the comments already - generally the more confrontational ones
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited experience with log collection (splunk, kiwi).
Very small network. <10 workstations (win7); 1 W...
Once I found something strange. It was a textfile which has stored stolen credentials but has been linked in the public so some people did nasty stuff. That's quite common but I was confused about something interesting:
Somebody linked the file the script write the credentials, but it looked like...
@RoryAlsop as usual, I'm gonna have to go against the crowd a bit...
totally agree about your actions, and that the dickishness was not yours.
but I think most of the actual question is ontopic here, its just hidden by all the rest of the crap.
if it werent for the aforementioned dickishness, I might have put in the effort to trim it to the essential ontopic questions, but as it is I can't be bothered.
@AviD hmmm - okay. I was definitely feeling it is all about "I did this then that, then it stopped working and I don't know why" and even now, looking at those 4 questions at the end, 1 and 2 are not answerable, really, 3 might be and only 4 is a decent question - but it is subjective
@RoryAlsop yeah, I agree - 80% of his question is basically a rant, or looking for emotional support.
but the bulleted questions - I think 1 and 4 are pretty much shopping list questions. but 2 and 3 are legit questions, just need to be cleaned up a bit....
2 is basically saying: given a certain set of circumstances, is it better to do asset discovery, or better to use agents? these are different approaches to SIEM, both valid, both fit better for different circumstances.
or at least, looking for the factors that would help in the tradeoff.
as for 3 (which is really very seperate), some general info on how SIEM policies work, and what they should be.
though that one might be more specific to that product.
anyway, that's my reading of it... and most of the question didnt really relate to that, anyway.
@ScottPack for sure. though when it comes to security products, "how to configure" is clearly SF, and "what should the configuration accomplish" is clearly sec.se - as is architecture, tradeoffs, etc.
For me, I tend to think about what kind of answer I want, and which group I think is most likely to know the answer.
Speaking of groups, wish me luck. Unless things go badly my players get to storm a farm full of Viking warriors in the middle of a funeral celebration.
I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform.
We expose a REST based API which our customers either call directly from their app servers, or their own client apps can all, on behalf of their users.
Their apps a...
I've been reading on various sites how PC get infected by viruses and I got:
Email attachments (but of course, only if I get an exe and open or execute something, right?)
Don't update windows
Downloads (the same as email attachments, right?)
Pros:
I can't think of any worthwhile.
Cons:
...
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited experience with log collection (splunk, kiwi).
Very small network. <10 workstations (win7); 1 W...
